Slashdot Mirror
What Could You Do With a Bogus Root Name Server?
Barlaam notes a post from the Renesys Blog which follows up on news they discussed a couple weeks ago about the 'identity theft' of a root name server. To emphasize the issue of safeguarding such a system, they've now posted an explanation of exactly how the situation could be exploited.
"It shouldn't be too hard to see that you could end up answering every DNS query from an organization that came to you for an updated list of root name servers. Every one. And you might end up doing this for a very long time, especially if your answers were largely correct. An attack like this would have no resemblance to the YouTube hijack, where the entire planet gets a blank page and it's immediately apparent that something isn't right. Obvious events like this will continue to occur, and we'll continue to resolve them relatively quickly. But as this incident demonstrates, DNS hijacks are far less obvious and potentially far more harmful."
.. do what we do every night.. try to take over the world!!
.... You could be cashing in big time..... )
(Seriously, Imagine borrowing every bank's front page in North America
i would redirect http://slashdot.org/ to http:///..org
yeah how funny is it now that the joke is on the other foot biatches!
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
If you have lost DNS, game is over, you lose. A recipe if your system hits a compromised root server.
Better yet, people often use similar IDs and passwords into other systems. Evil hackers can often use the email to figure out which banks, credit, stock brokers and on line e-tailers you use. Maybe change the home address of your Amazon account and order stuff, if the e-tailor isn't right on top of it.
Root servers need to be secure, end of story.
I should note the above method would also work with SSL, be creative, it only has to be a legitimate cert with a root chain.
Back in Febrary 2006 I wrote a note "What Could You Do With Your Own Root Server" at
http://www.cavebear.com/cbblog-archives/000232.html
My conclusions were that one could make money and cause trouble.
One of the more interesting aspects was (and still is) that one could operate root servers and, using the Google model, pay ISPs and users to send their queries to your roots so that you could generate data mining revenues.
That quality of data that is minded form root traffic would not be as good as that as from a top level domain server - and who has some large top level domains and also has root servers? Verisign.
And ICANN's contract with Verisign explicitly permits data mining of query traffic.
You could send all Obama's web traffic to Clinton's web site ... oops, already been done!
I think the OP's referring to TSIG and it's variants.
DNSSEC has gone through three (3) mutually incompatible specifications. The DNSSEC people are claiming that the last revision really really works, honest, gov, and that all that remains to be done is deploying it.
But they don't appear to be deploying it on their own servers.
But they don't appear to be deploying it on their own servers.
I've just checked -- and the ISC do sign their zone. Sorry for the mis-information.
World-wide Rickroll?
Interested in open source engine management for your Subaru?
I'm sick of following my dreams. I'm just going to ask where they're goin' and hook up with 'em later.
Goatse.cx lives!
Have gnu, will travel.
Digitally signing every DNS request? Good luck handling the computational load :)
You don't need to sign the requests, you need to sign the replies. And you only need to compute the signing once, and store the signed value.
Exactly. If you think the problem is bad now, wait until we've fixed it. (Arthur Kasspe). This should be the motto engraved on every Government departmental seal.
Faster! Faster! Faster would be better!
Ooh, I have an idea. We could request only the parts of the file we actually need. Then we could probably do it in real time; the load on the master server will possible get too heavy, though. I know, our ISPs could cache local copies, and we could split the file into hierarchical chunks.
;)
Hey, I oughta' write up an RFC on this